AWS Certified CloudOps Engineer - Associate (formerly SysOps Administrator - Associate) (SOA-C03) practice questions

Domain coverage 5 domains

• Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)
• Reliability and Business Continuity (22%)
• Deployment, Provisioning, and Automation (22%)
• Security and Compliance (16%)
• Networking and Content Delivery (18%)

Sample questions 10 of 100 shown

1. Q1 Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

   An operations team needs to receive immediate notification when EC2 CPU utilization consistently exceeds 85% for 10 minutes. What is the simplest combination to implement?

   1. CloudWatch alarm with an SNS topic action
   2. CloudTrail trail with email subscription
   3. AWS Config rule with custom Lambda
   4. EventBridge rule that polls CloudWatch every minute

   Create a CloudWatch metric alarm on the CPUUtilization metric with a threshold of 85%. Set EvaluationPeriods=10 and Period=60 (or 2/300), and configure an SNS topic as the alarm action. When the alarm triggers, SNS delivers notifications via email, SMS, or other endpoints. CloudTrail records API calls, not performance metrics. Config rules evaluate resource compliance. EventBridge can react to alarm state changes but doesn't replace CloudWatch alarms.
2. Q2 Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

   A CloudOps engineer wants to create a single alert that triggers only when CPUUtilization > 80% AND NetworkIn > 50 MB/s are both true simultaneously on the same instance. Which CloudWatch feature is purpose-built for this?

   1. Anomaly detection band
   2. Composite alarm using ALARM("cpu") AND ALARM("net")
   3. Metric math expression with IF()
   4. Contributor Insights rule

   Composite alarms use Boolean logic (AND, OR, NOT) to combine multiple existing alarms into a single alarm state. Create two individual metric alarms (CPU and network), then a composite alarm with AND logic. This reduces alarm noise by only notifying when both conditions are met. Anomaly detection learns baselines. Metric math operates on time series, not alarm states. Contributor Insights analyzes top contributors to metrics.
3. Q3 Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

   An EC2 fleet does not report memory or disk usage by default. What is the recommended way to publish these metrics to CloudWatch?

   1. Enable detailed monitoring on the instance
   2. Install the unified CloudWatch agent and configure it for memory and disk
   3. Subscribe the EC2 instance to CloudTrail Insights
   4. Enable AWS Compute Optimizer

   Memory and disk are guest-OS-level metrics that the hypervisor cannot see. The unified CloudWatch Agent runs inside the OS and collects mem_used_percent, disk_used_percent, swap, and process-level metrics, publishing them as custom metrics under the CWAgent namespace. Detailed monitoring (Option A) only increases the frequency of standard EC2 metrics (CPU, network, disk I/O from the hypervisor). CloudTrail Insights (Option C) analyzes API patterns. Compute Optimizer (Option D) provides right-sizing recommendations.
4. Q4 Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

   A team wants to use metric math to calculate a 5-minute error rate as Errors/Requests * 100, avoiding division by zero when Requests is zero. Which expression correctly handles this?

   1. SUM(METRICS()) * 100
   2. IF(m_req > 0, m_err / m_req * 100)
   3. ANOMALY_DETECTION_BAND(m_err, 2)
   4. RATE(m_err)

   The IF() function in CloudWatch metric math checks a condition and returns one value if true and another (or NaN) if false. IF(m_req > 0, m_err / m_req * 100) returns NaN when requests are zero, preventing alarms from triggering on division-by-zero artifacts. This produces clean time series suitable for alarming. SUM and RATE are aggregation functions. ANOMALY_DETECTION_BAND is for anomaly detection.
5. Q5 Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

   Which CloudWatch Logs Insights query returns the count of ERROR-level log lines grouped by 5-minute time buckets?

   1. fields @message | filter @message like /ERROR/ | stats count() by bin(5m)
   2. stats avg(@duration) by @logStream
   3. parse @message " ERROR " as msg | display msg
   4. filter level="ERROR" | sort @timestamp asc | limit 100

   The standard Logs Insights pattern for time-bucketed counting: filter records matching a pattern, then use stats count() by bin(5m). The bin() function groups by time interval. This is the classic approach for charting error volume over time. Option B calculates average duration per log stream. Option C parses but doesn't count. Option D only returns the first 100 records sorted by time.
6. Q6 Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

   A central security account needs to aggregate read-only views of CloudWatch dashboards and alarms from 30 member accounts, without requesting cross-account roles for each call. What is the simplest 2026 solution?

   1. CloudWatch cross-account observability with a monitoring account and source accounts linked through Oversight
   2. Manual STS AssumeRole into each member account from the security account
   3. S3 replication of dashboard JSON between accounts
   4. Resource Access Manager share of CloudWatch namespaces

   CloudWatch cross-account observability (via AWS Organizations Oversight) allows a designated monitoring account to view metrics, logs, traces, and Application Insights from linked source accounts without per-call AssumeRole. This provides organization-wide operational visibility. Manual STS (Option B) requires per-call role assumption and is not scalable. S3 replication (Option C) provides copies, not live dashboards. RAM share (Option D) is not a CloudWatch feature for this purpose.
7. Q7 Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

   Which CloudWatch alarm pattern is best suited for metrics that have normal level variations based on day of week and time of day, such as weekend vs. weekday traffic?

   1. Static threshold alarm with 3 evaluation periods
   2. Anomaly detection alarm using a 2 standard deviation band
   3. Composite alarm OR-ing two static alarms
   4. Contributor Insights alarm

   Anomaly detection learns the seasonal patterns of a metric (time of day, day of week) and triggers when values fall outside the predicted band. It automatically adapts to regular patterns, making it ideal for metrics with known cyclical behavior. Static thresholds (Option A) would require manual adjustment for weekends. Composite alarms (Option C) combine other alarms. Contributor Insights (Option D) identifies top contributors.
8. Q8 Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

   A CloudOps engineer needs to forward all VPC Flow Log records matching a rejected-traffic pattern to a Lambda function for real-time categorization. Which feature should be used?

   1. CloudWatch Logs metric filter
   2. CloudWatch Logs subscription filter to Lambda
   3. S3 event notification on the Flow Log bucket
   4. CloudTrail Lake federated query

   Subscription filters on log groups stream matching events near-real-time to Lambda, Kinesis Data Streams, or Firehose. A metric filter (Option A) creates numerical metrics from log patterns but doesn't forward individual events. S3 event notifications (Option C) fire on object creation, but Flow Logs to S3 are batched with delivery latency. CloudTrail Lake (Option D) is for audit trail querying.
9. Q9 Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

   A compliance team needs to query 18 months of CloudTrail events across all accounts in an organization using SQL. Which option scales best with the lowest operational overhead?

   1. Stream events to OpenSearch via subscription filters
   2. Enable a CloudTrail Lake organization data store and run SQL queries
   3. Athena over the central S3 trail with daily partitions
   4. Replay events nightly through a Lambda transformer

   CloudTrail Lake provides a managed event data store with SQL query support, organization-level aggregation, and configurable retention of up to 7 years. No partition management, OpenSearch cluster operations, or data transformation pipelines are needed. Option A requires managing OpenSearch. Option C requires partition management and optimizing Athena queries. Option D adds complexity and cost.
10. Q10 Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

    A CloudOps team wants to audit GetObject API calls on a specific S3 bucket. Which CloudTrail event type must be enabled?

    1. Management events
    2. Data events for S3
    3. Insight events
    4. Network activity events

    Object-level operations like GetObject and PutObject are S3 data events. They are disabled by default due to volume and cost implications and must be manually enabled per-bucket or per-prefix in the trail configuration. Management events (Option A) cover control plane operations (create bucket, modify policy) but not object-level access. Insight events (Option C) detect unusual API activity patterns.

Answer all 100 questions with instant feedback →

Reader reviews 570 ratings

• The SOA-C03 practice test is spot-on. The multi-select questions and explanations are exactly what you need for the real exam.

  ★★★★★★ Emily R.

• I bought the SOA-C03 question bank a week before my exam and passed with 90%+. The questions are that good.

  ★★★★★ Maria V.

• I passed SOA-C03 on my first try thanks to these practice questions. The unlimited retakes were essential for building confidence.

  ★★★★★ Nicole K.

• The question explanations for SOA-C03 really dig into the AWS (or relevant) concepts. Helped me understand things at a deeper level.

  ★★★★★★ Hazel C.

• Took the SOA-C03 exam today and passed with 87%. Used this as my main prep material for about a month.

  ★★★★★★ Grace L.

• I let my coworker borrow my SOA-C03 account to study — he passed too. These questions are legit.

  ★★★★★★ Grayson P.

Frequently asked questions

Free study resources

Community-verified analysis of 77 questions from real test-taker discussions — 9 deep analyses and 0 FAQs.

More Amazon exams